Activity timeline
T1573.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 48 reports, and 155 of the 155 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1573.001 Symmetric Cryptography is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of T1573 Encrypted Channel. Threadlinqs maps 155 of 2623 tracked threats (5.9%) to it; by severity that is 35 critical, 110 high, 10 medium.
Threats that use T1573.001 most often also use T1071.001 Web Protocols (126 threats), T1027 Obfuscated Files or Information (114 threats), T1082 System Information Discovery (112 threats), T1140 Deobfuscate/Decode Files or Information (104 threats), T1036.005 Match Legitimate Resource Name or Location (89 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
67 tracked threat actors appear in the threats that use T1573.001; the most frequent are APT38 (9), Sapphire Sleet (7), Stardust Chollima (7), WageMole (5), UNC1069 (4).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1573.001.
Data sources
Telemetry that can reveal T1573.001, per MITRE ATT&CK.
- Network Traffic — Network Traffic Content
Threat actors using it
Tracked threats
The 30 most recent of 155 tracked threats that use T1573.001.
- BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…high
- CloudSyncD macOS Backdoor Delivered via Fake Zoom Installerhigh
- 2CLoader: New Malware Loader Delivering Vidar, Remus and XWormhigh
- NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operationshigh
- CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…critical
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)critical
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…high
- Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packageshigh
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via…high
- CLOSEDQUORUM: First Reported Autonomous AI-Driven C2 Implant Using LLM Plurality Voting (Windows Infostealer)medium
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panelmedium
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented…medium
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and…critical
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)high
- ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a…high
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious…high
- PeckBirdy JScript C2 Framework Hides China-Aligned APT Infrastructure Inside a Casino-Site Network…high
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkitcritical
- Smishing Triad "Outsider" Operator: JWR Phishing Kit's AES-256-CTR WebSocket Exfiltration Cockpithigh
- Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding…high
- CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malwarecritical
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C…medium
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chainhigh
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2high
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport…critical
- APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer…high
- StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Storescritical
- REVSTEALER Infostealer Campaign: Four C2-Delivered Modules Disable Windows Update & Defender to Deploy XMRig…high
- TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industryhigh
- Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholinghigh
Detection coverage
Threadlinqs maintains 479 detection rules mapped to T1573.001 (SPL 197, KQL 123, Sigma 159). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1573 Encrypted Channel — 364 tracked threats at the technique level.